It's sad that it's so buried [1], because I think the theory you mention deep in the thread is most plausible: people scraped your username, guessed the email address <username>@facebook.com and uploaded that, and Facebook associates that email address with your account.

[1] https://news.ycombinator.com/item?id=19103490